# Beat version in index name

**URL:** <https://discuss.elastic.co/t/beat-version-in-index-name/207092>\
**Category:** Logstash\
**Created:** [November 8, 2019, 10:41am UTC](https://discuss.elastic.co/t/beat-version-in-index-name/207092 "2019-11-08T10:41:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [November 8, 2019, 10:41am UTC](https://discuss.elastic.co/t/beat-version-in-index-name/207092/1 "2019-11-08T10:41:20Z")

</div>

Hi All,

I am using ELK 6.8.0 and I want to add the beat version to the indexname I have configured in an Logstash output. I have configured it currently like this

> clog-%{[beat][version]}-%{+YYYY.MM.dd}

But that gives me an index name of

> clog-%{[beat][version]}-2019.11.08

How do I access those fields in the document?

---

<div class="post-metadata">

**Author:** ![Moritz\_Kiesewetter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moritz_kiesewetter/32/51243_2.png) [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\
**Post date:** [November 8, 2019, 11:19am UTC](https://discuss.elastic.co/t/beat-version-in-index-name/207092/2 "2019-11-08T11:19:01Z")

</div>

Should be something like this :

> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"

atleast it works for me 🙂

---

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [November 8, 2019, 11:39am UTC](https://discuss.elastic.co/t/beat-version-in-index-name/207092/3 "2019-11-08T11:39:20Z")

</div>

Yeah I have tried that to but that doesn't work either..I do not have @metadata fields.

```
{
                "tags" => [
        [0] "dovecot",
        [1] "MC",
        [2] "beats_input_codec_plain_applied"
    ],
                "host" => "name",
              "source" => "/var/log/dovecot/info.log",
             "message" => "full message",
    "source_affiliate" => "ukmail",
          "prospector" => {
        "type" => "log"
    },
           "beat_used" => "true",
              "offset" => 34120721,
            "@version" => "1",
          "@timestamp" => 2019-11-08T08:26:21.688Z,
                "beat" => {
         "version" => "6.2.4",
        "hostname" => "name",
            "name" => "name.local"
    }
}
```

---

<div class="post-metadata">

**Author:** ![Moritz\_Kiesewetter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moritz_kiesewetter/32/51243_2.png) [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\
**Post date:** [November 12, 2019, 3:11pm UTC](https://discuss.elastic.co/t/beat-version-in-index-name/207092/4 "2019-11-12T15:11:04Z")

</div>

Have you tried to Grok Match the Beat Name from the Plain Log? And simply use the fieldname in which you put the Value In the Indexname? I don't really know the format of your logs so i can't just paste random stuff in here.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 10, 2019, 3:11pm UTC](https://discuss.elastic.co/t/beat-version-in-index-name/207092/5 "2019-12-10T15:11:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.